USG防火墙IPSecVPN配置

《USG防火墙IPSecVPN配置》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、实用文档场景公司的网络分为总部区域、分部网络和分支办公室三个部分。要求分部Trust区域的用户和分支办公室能够访问总部Trust区域。传输的数据需要加密。步骤一：基本配置system-view[Huawei]sysnameR1[R1]interfaceGigabitEthernet0/0/1[R1-GigabitEthernet0/0/1]ipaddress10.0.10.224[R1-GigabitEthernet0/0/1]interfaceSerial1/0/0[R1-Seri

2、al1/0/0]ipaddress10.0.12.124[R1-Serial1/0/0]interfaceloopback0标准文案实用文档[R1-LoopBack0]ipaddress10.0.1.124[Huawei]sysnameR2[R2]interfaceGigabitEthernet0/0/2[R2-GigabitEthernet0/0/2]ipaddress10.0.20.124[R2-GigabitEthernet0/0/2]interfaceSerial1/0/0[R2-Seria

3、l1/0/0]ipaddress10.0.12.224[R2-Serial1/0/0]interfaceloopback0[R2-LoopBack0]ipaddress10.0.2.224[Huawei]sysnameR3[R3]interfaceSerial2/0/0[R3-Serial2/0/0]ipaddress10.0.23.324[R3-Serial2/0/0]interfaceloopback0[R3-LoopBack0]ipaddress10.0.3.324配置FW1和FW2防火墙

4、SG2100>system-view标准文案实用文档[USG2100]sysnameFW1[FW1]interfaceEthernet0/0/0[FW1-Ethernet0/0/0]ipaddress10.0.100.124[FW1-Ethernet0/0/0]interfaceEthernet2/0/0[FW1-Ethernet2/0/0]ipaddress10.0.10.124[FW1-Ethernet2/0/0]interfacevlanif1[FW1-Vlanf1]undoipaddress

5、system-view[USG2100]sysnameFW2[FW2]interfaceEthernet0/0/0[FW2-Ethernet0/0/0]ipaddress10.0.200.124[FW2-Ethernet0/0/0]interfaceEthernet2/0/0[FW2-Ethernet2/0/0]ipaddress10.0.20.124[FW2-Ethernet2/0/0]interfacevlanif1[FW2-Vlanf1]undoipaddress[FW1]f

6、irewallzoneuntrust标准文案实用文档[FW1-zone-untrust]addinterfaceEthernet2/0/0[FW1-zone-untrust]undoaddinterfaceEthernet0/0/0[FW1-zone-untrust]quit[FW1]firewallzonetrust[FW1-zone-trust]addinterfaceEthernet0/0/0[FW2]firewallzoneuntrust[FW2-zone-untrust]addinterf

7、aceEthernet2/0/0[FW2-zone-untrust]undoaddinterfaceEthernet0/0/0[FW2-zone-untrust]quit[FW2]firewallzonetrust[FW2-zone-trust]addinterfaceEthernet0/0/0步骤二：配置区域的安全过滤[FW1]firewallpacket-filterdefaultpermitinterzonetrustuntrust//允许trust访untrust区域[FW1]firewal

8、lpacket-filterdefaultpermitinterzonelocaluntrust[FW2]firewallpacket-filterdefaultpermitinterzonetrustuntrust标准文案实用文档[FW2firewallpacket-filterdefaultpermitinterzonelocaluntrust步骤三：配置路由[R1]ospf1[R1-ospf-1]area0.0.0.0[R1-ospf-1-area-0.0.0.